@rubytech/create-maxy-code 0.1.506 → 0.1.507

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -5,33 +5,43 @@ tools:
   - name: schedule-event
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: schedule-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: schedule-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-cancel
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-export-ics
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-import-ics
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-archive-ics
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-connector-busy-sync
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: time-resolve
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 skills:
   - skills/daily-prep/SKILL.md
   - skills/briefing/SKILL.md

package/payload/platform/plugins/storage-broker/PLUGIN.md

@@ -6,39 +6,51 @@ tools:
   - name: storage-d1-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-d1-create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-d1-query
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-r2-bucket-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-r2-bucket-create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-r2-object-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-r2-object-get
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-r2-object-put
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-r2-object-delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-pages-create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-pages-deploy
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-pages-adopt
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
 metadata: {"platform":{"embed":["admin"]}}
 mcp:
   command: node

package/payload/platform/plugins/telegram/PLUGIN.md

@@ -6,12 +6,15 @@ tools:
   - name: message
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: message-history
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: telegram-webhook-register
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
 mcp:
   command: node
   args:

package/payload/platform/plugins/url-get/PLUGIN.md

@@ -17,6 +17,7 @@ tools:
   - name: url-get
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 always: true
 embed: false
 ---

package/payload/platform/plugins/voice-mirror/PLUGIN.md

@@ -7,18 +7,23 @@ tools:
   - name: voice-tag-content
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: voice-distil-profile
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: voice-retrieve-conditioning
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: voice-record-feedback
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: voice-ingest-session-text
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 mcp:
   command: node
   args:

package/payload/platform/plugins/whatsapp/PLUGIN.md

@@ -5,39 +5,51 @@ tools:
   - name: whatsapp-login-start
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-login-wait
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-status
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-disconnect
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-config
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: whatsapp-activity
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-conversations
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-messages
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-conversation-graph-state
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-group-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-send-admin
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-reply
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
 metadata: {"platform":{"embed":["admin"]}}
 mcp:
   command: node

package/payload/platform/plugins/work/PLUGIN.md

@@ -5,48 +5,63 @@ tools:
   - name: work-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: work-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: work-relate
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-complete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-ready
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: session-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: session-name
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: session-metering
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: project-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: project-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: project-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: project-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: project-complete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
 metadata: {"platform":{"always":false,"embed":[],"pluginKey":"work"}}
 skills:
   - skills/execute-task/SKILL.md

package/payload/platform/plugins/workflows/PLUGIN.md

@@ -5,27 +5,35 @@ tools:
   - name: workflow-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: workflow-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: workflow-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: workflow-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: workflow-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: workflow-validate
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: workflow-execute
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: exec
   - name: workflow-runs
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 metadata: {"platform":{"always":false,"embed":[],"pluginKey":"workflows"}}
 mcp:
   command: node

package/payload/platform/scripts/check-risk-class.mjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// Publish-time gate: flag any `riskClass` declaration that contradicts what the
+// tool's own name says it does.
+//
+// The session manager throws at boot when a riskClass is absent or off-enum
+// (tool-surface.ts 'risk-class-missing' / 'risk-class-invalid'). It cannot
+// catch a class that is present, valid, and wrong — `whatsapp-send` declared
+// `read` parses fine, logs nothing, and stays invisible until a downstream
+// gate acts on it. That is a no-event failure, so it needs a standing check
+// rather than an event.
+//
+// The gate reports; it never rewrites a declaration. A contradiction is
+// resolved either by correcting the manifest or by adding a named exception
+// below with the reason it is not a mistake. An exception whose tool no longer
+// contradicts is itself reported: a suppression that outlives its cause
+// re-creates the blind spot the gate exists to remove.
+
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const MAXY_CODE_ROOT = resolve(__dirname, '..', '..')
+
+const PLUGIN_ROOTS = [
+  { root: join(MAXY_CODE_ROOT, 'platform', 'plugins'), depth: 1 },
+  { root: join(MAXY_CODE_ROOT, 'premium-plugins'), depth: 1 },
+  { root: join(MAXY_CODE_ROOT, 'premium-plugins'), depth: 2, mid: 'plugins' },
+]
+
+// A name that says the call sends something outward, declared as if it stays
+// on the device.
+const OUTWARD_SIGNAL = /-(send|reply|publish|deploy|delete|post)\b/
+const OUTWARD_CONTRADICTS = new Set(['read', 'write_local'])
+
+// A name that says the call only looks at something, declared as if it acts.
+const INWARD_SIGNAL = /-(read|list|search|status|info|get)\b/
+const INWARD_CONTRADICTS = new Set(['external', 'exec'])
+
+/** Named exceptions. Each entry suppresses exactly one tool+class pair and
+ *  must carry the reason the name signal is misleading for that tool. */
+const EXCEPTIONS = [
+  {
+    tool: 'joblogic-job-set-status',
+    riskClass: 'external',
+    reason: 'The -status suffix reads as a query, but this sets a job status on the remote JobLogic tenant. external is correct and the name signal is what is wrong here.',
+  },
+  {
+    tool: 'memory-delete',
+    riskClass: 'write_local',
+    reason: 'Soft-deletes a node in the local Neo4j graph. Trashed nodes still resolve by elementId; nothing leaves the device.',
+  },
+  {
+    tool: 'contact-delete',
+    riskClass: 'write_local',
+    reason: 'Removes a contact from the local graph. No remote address book is touched.',
+  },
+  {
+    tool: 'profile-delete',
+    riskClass: 'write_local',
+    reason: 'Removes a profile node from the local graph.',
+  },
+  {
+    tool: 'workflow-delete',
+    riskClass: 'write_local',
+    reason: 'Removes a workflow definition from the local graph. Any run history it produced is untouched.',
+  },
+]
+
+function collectPluginDirs() {
+  const dirs = []
+  for (const spec of PLUGIN_ROOTS) {
+    if (!existsSync(spec.root)) continue
+    for (const entry of readdirSync(spec.root)) {
+      if (entry.startsWith('.')) continue
+      const lvl1 = join(spec.root, entry)
+      if (!statSync(lvl1).isDirectory()) continue
+      if (spec.depth === 1) {
+        dirs.push(lvl1)
+        continue
+      }
+      const mid = join(lvl1, spec.mid)
+      if (!existsSync(mid) || !statSync(mid).isDirectory()) continue
+      for (const sub of readdirSync(mid)) {
+        if (sub.startsWith('.')) continue
+        const lvl2 = join(mid, sub)
+        if (statSync(lvl2).isDirectory()) dirs.push(lvl2)
+      }
+    }
+  }
+  return dirs
+}
+
+/** Independent of tool-surface.ts on purpose: a gate that shares the parser it
+ *  is checking cannot detect that parser drifting. */
+function declaredTools(manifestPath) {
+  const out = []
+  let current = null
+  let inTools = false
+  for (const line of readFileSync(manifestPath, 'utf8').split(/\r?\n/)) {
+    if (/^tools:\s*$/.test(line)) { inTools = true; continue }
+    if (inTools && /^[A-Za-z_]/.test(line)) inTools = false
+    if (!inTools) continue
+    const name = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
+    if (name) { current = name[1]; continue }
+    const risk = line.match(/^\s+riskClass:\s*(.+?)\s*$/)
+    if (risk && current) { out.push({ tool: current, riskClass: risk[1].trim() }); current = null }
+  }
+  return out
+}
+
+const contradictions = []
+const matchedExceptions = new Set()
+let scanned = 0
+
+for (const dir of collectPluginDirs()) {
+  const manifest = join(dir, 'PLUGIN.md')
+  if (!existsSync(manifest)) continue
+  for (const { tool, riskClass } of declaredTools(manifest)) {
+    scanned++
+    let signal = null
+    if (OUTWARD_SIGNAL.test(tool) && OUTWARD_CONTRADICTS.has(riskClass)) signal = 'outward-name'
+    if (INWARD_SIGNAL.test(tool) && INWARD_CONTRADICTS.has(riskClass)) signal = 'inward-name'
+    if (!signal) continue
+    const excepted = EXCEPTIONS.find((e) => e.tool === tool && e.riskClass === riskClass)
+    if (excepted) { matchedExceptions.add(`${tool}:${riskClass}`); continue }
+    contradictions.push({ tool, riskClass, signal, plugin: dir.replace(`${MAXY_CODE_ROOT}/`, '') })
+  }
+}
+
+const stale = EXCEPTIONS.filter((e) => !matchedExceptions.has(`${e.tool}:${e.riskClass}`))
+
+for (const c of contradictions) {
+  console.error(`[risk-class] contradiction tool=${c.tool} declared=${c.riskClass} signal=${c.signal} plugin=${c.plugin}`)
+}
+for (const s of stale) {
+  console.error(`[risk-class] stale-exception tool=${s.tool} riskClass=${s.riskClass} — no longer contradicts; remove it from EXCEPTIONS`)
+}
+
+if (contradictions.length > 0 || stale.length > 0) {
+  console.error(`[gate] check-risk-class: FAIL (${contradictions.length} contradiction(s), ${stale.length} stale exception(s), ${scanned} tools scanned)`)
+  process.exit(1)
+}
+
+console.log(`[gate] check-risk-class: PASS (${scanned} tools scanned, ${EXCEPTIONS.length} named exception(s))`)

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -29,7 +29,10 @@ provision_account_dir() {
   # Operator-data buckets (entity-anchored, flat) + tool-owned dirs. agents/ and
   # specialists/ are created above. The seeded SCHEMA.md is the single source of
   # the allowed top-level set, parsed at runtime by the fs-schema write guard.
-  local _seed_dirs=(projects contacts documents url-get output generated extracted uploads)
+  # `sites` joins the seed set because it is a home bucket in the /data browser
+  # (HOME_FIXED); an unseeded home bucket is reported by the standing
+  # home-parity audit as missing on every account that has not published a site.
+  local _seed_dirs=(projects contacts documents url-get output generated extracted uploads sites)
   local _d _seeded=0
   for _d in "${_seed_dirs[@]}"; do
     [ -d "$ACCOUNT_DIR/$_d" ] || { mkdir -p "$ACCOUNT_DIR/$_d" && _seeded=$((_seeded+1)); }

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAoBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAoBxD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAsnGpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAoBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAoBxD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA0nGpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -1343,6 +1343,10 @@ export function buildHttpApp(deps) {
                 sessionId: row.sessionId,
                 live: row.state === 'live',
                 status: row.status,
+                // Task 1997 — the account this row belongs to, so an SSE consumer can
+                // scope its fan-out instead of broadcasting install-wide. Already on
+                // the row (Task 1769); it was simply never put on the wire.
+                accountId: row.accountId,
                 agentLabel,
                 cwd: row.cwd,
                 firstPrompt,